Apple fixes 12 vulnerabilities
by admin on Jan.21, 2010, under Uncategorized
Apple fixes a dozen holes in Mac OS X
by Elinor Mills
Apple fixes a dozen vulnerabilities affecting Mac OS X 10.5 and 10.6 in its first security update for the year released on Wednesday.The security update addresses several issues with the Flash Player plug-in, including one that could allow an attacker to take control of the computer if the user visits a malicious Web site.
Also patched were holes in CoreAudio, ImageIO, and Image RAW that could lead to arbitrary code execution and allow an attacker to take control of the computer if a malicious MP4 audio file were played, or malicious TIFF (Tagged Image File Format) or DNG (Digital Negative) images were viewed.
The release also affects OpenSSL, fixing a man-in-the-middle vulnerability that exists in the SSL (Secure Sockets Layer) and TLS (Transport Layer Security) protocols used to secure communications over the Internet. The vulnerability, discovered by researchers at PhoneFactor in August 2009, could allow someone to capture data or modify operations performed in protected sessions.
In addition, a hole in the CUPS printing service was plugged that could allow an attacker to cause a remote denial-of-service by issuing a malicious get-printer-jobs request.
http://news.cnet.com/8301-27080_3-10438313-245.html?tag=mncol;title
It always amazes me the tone change when people announce Apple’s patches versus Microsoft. The headline could easily have been “Apple fails to fix serious SSL vulnerability for five months”. SSL isn’t really that important though. I mean we are only talking about snooping in on your ’secure’ banking transactions and the like, right?
A 17 year old bug found in Windows
by admin on Jan.21, 2010, under BSOD
Microsoft confirms 17-year-old Windows vulnerability
Posted by Ryan Naraine @ 8:05 am
One day after a Google security researcher released code to expose a flaw that affects every release of the Windows NT kernel — from Windows NT 3.1 (1993) up to and including Windows 7 (2009) — Microsoft dropped a security advisory to acknowledge the issue and warn of the risk of privilege escalation attacks.Microsoft warns that a malicious hacker could exploit this vulnerability to run arbitrary code in kernel mode. For an attack to be successful, the attacker must have valid logon credentials.
The flaw does not affect Windows operating systems for x64-based and Itanium-based computers, Microsoft said.
http://blogs.zdnet.com/security/?p=5307&tag=content;col1
As far as vulnerabilities go, being able to run arbitrary code in kernal mode is about as serious as it comes. To me, this gives another good reason to go to the 64 bit version if you haven’t already. While it may seem surprising to some that the same bug that existed in NT still exists in Windows 7, but you have to remember that users are funny creatures that expect all the programs they bought twenty years ago to still work. Do you really think Microsoft coders redo every module with each new release? Of course not.
Many point out that MS knew about the bug for several months and acted slowly. I would have to agree that an advisory was in order and a patch as soon as possible.
There does come a time when MS needs to drop support entirely for legacy applications or at a minimum, make the administrator install legacy support only if needed rather than having it turned on by default. I really don’t imagine many folks require 16 bit application support in 2010. Maybe I am wrong?
Paula Dockery’s campaign hacked
by admin on Jan.21, 2010, under Hack Attack
Cyber hacker hits Paula Dockery’s campaign site
The campaign of Sen. Paula Dockery, a Lakeland Republican running for government on a clean-up-government platform, was hit with a sophisticated computer hack this week that clogged her website.
Her campaign is fixing the problem. The FBI has been notified of the attack, but it’s unclear what it can do.
Here’s an excerpt of an email from her tech support guru on the attack sent yesterday, Tuesday Jan. 19:
http://blogs.tampabay.com/buzz/2010/01/cyber-hacker-hits-paula-dockerys-campaign-site.html
Not super interesting. Just looks like a DDOS. It is funny how the technicians paint the adversary as being ‘advanced’. Really, this is a painfully simple attack that could be performed by a script kiddie or a paid bot herder.
Welcome to the information security blog!
by admin on Jan.21, 2010, under Uncategorized
Often the news stories gloss over the details of incidents and only focus on the sensational bits that appeal to the public. Hopefully, here we can delve a bit deeper.
